GHSA-2wqw-hr4f-xrhh
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2wqw-hr4f-xrhh
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-2wqw-hr4f-xrhh/GHSA-2wqw-hr4f-xrhh.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2wqw-hr4f-xrhh
- Aliases
- Published
- 2024-03-06T17:02:34Z
- Modified
- 2024-03-21T18:25:32Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- RSSHub Cross-site Scripting vulnerability caused by internal media proxy
- Details
-
Impact
When the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.
Users who access the deliberately constructed URL are affected.
Patches
This vulnerability was fixed in version https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87. Please upgrade to this or a later version.
Workarounds
No.
- Database specific
{ "github_reviewed": true, "github_reviewed_at": "2024-03-06T17:02:34Z", "nvd_published_at": "2024-03-21T02:52:21Z", "severity": "MODERATE", "cwe_ids": [ "CWE-79" ] }- References
Affected packages
npm / rsshub
Package
- Name
- rsshub
- View open source insights on deps.dev
- Purl
- pkg:npm/rsshub